Implementing Safety Encoder Rotation Monitoring on Siemens F-CPU Systems

Detecting whether a rotating machine element is in motion is a recurring safety requirement in motion control applications. When the load is a saw blade, centrifuge, press flywheel, or any machine whose stored kinetic energy must be dissipated before guards can be released, the safety function "rotation monitored zero speed" must be implemented with the same rigor as any other protective function. On Siemens F-CPU systems, this means pairing a safety encoder with a PROFIsafe channel and processing its position/speed values inside a fail-safe program. The legacy FM 350-1 / FM 350-2 counter modules are not safety devices and cannot be used to satisfy EN ISO 13849-1 Cat. 3/PL d or IEC 61508 SIL 2 requirements. This reference covers the engineering required to replace that non-safe path with an F-rated architecture.

1. Safety Encoder Fundamentals

A safety encoder is a position-measuring device whose internal architecture supports a fail-safe data channel. Unlike a standard incremental encoder, every safety encoder contains at least two independent sensing elements (typically two opto-ASICs with mechanically offset code discs) and a microcontroller that performs cross-comparison of the two channels, CRC generation, and validity diagnostics. The output protocol is a safe bus such as PROFIsafe over PROFINET, PROFIsafe over PROFIBUS, or Safety over EtherCAT (FSoE). SIL 2 / PL d devices include:

• SICK AHS36 / AHM36 – 16-bit singleturn / 12-bit multiturn absolute, PROFIsafe, MTTFd > 100 years, SIL 2 / PL d. See SICK safety encoders product portal.
• SICK DFS60S – incremental safety encoder up to 65,536 ppr, SIL 2 / PL d, PROFIsafe variant available.
• IFM RM9xxx – magnetic safety encoder with PROFIsafe interface, see IFM safety encoder technology page.
• Kübler Sendix F5868 / F5888 – optical PROFIsafe absolute encoder, SIL 2 / PL d.
• Heidenhain ECN/EQN 1300S – EnDat22 safety variant certified to SIL 2.

2. IEC 61800-5-2 Safety Functions for Rotation Detection

IEC 61800-5-2 defines the safety functions that operate on drive-integrated or external position feedback. The relevant functions for "is the load rotating?" are:

• SS1 (Safe Stop 1) – controlled stop with monitoring of the deceleration ramp; rotation may continue during the controlled phase.
• SS2 (Safe Stop 2) – controlled stop, then transition to SOS; rotation must be monitored down to zero.
• SOS (Safe Operating Stop) – power retained, position held within a window.
• SLS (Safely-Limited Speed) – speed must be measured continuously; if v > v_max, the safe state is entered.
• SSM (Safe Speed Monitor) – output signal that indicates whether speed is below a threshold; this is the function that produces the "rotation = no" bit the application requires.

The target here is SSM: the safety encoder reports the current speed to the F-CPU, and the F-program sets a tag such as i_RotationActive high while |v| > v_threshold. Guard interlock logic (safety door, light curtain, two-hand control) uses this tag to prevent opening until SSM is low.

3. Siemens F-CPU Architecture Required

Siemens fail-safe CPUs that can act as F-Host for a PROFIsafe safety encoder include:

All F-CPUs run two program organizations: the standard OB 1 (or OB 123 for S7-1200) and the fail-safe OB 82 / OB 35 (F-OB). The F-program can read PROFIsafe inputs only through the dedicated i_SafetyInput tags generated by the F-CPU, never via direct PEW access.

4. Counter Module Limitations – Why FM 350 Is Not Acceptable

The FM 350-1 (6ES7350-1AH03-0AE0) and FM 350-2 (6ES7350-2AH01-0AE0) provide high-speed counting but carry no SIL/PL rating. They detect broken wire on the 24 V encoder supply, but cannot detect a stuck shaft, glass disc damage, or a fractured bearing. Using a 500 ppr standard encoder on FM 350 and computing speed in the F-program is a recurring suggestion in field discussions; it is not an acceptable safety path because:

1. The encoder is single-channel – no internal cross-comparison.
2. The module is not fail-safe – internal faults are not diagnostics-covered.
3. The diagnostic time is not bounded to the value required by PFHd calculation.

The same restriction applies to the S7-1500 TM Count 2x24V (6ES7550-1AA00-0AB0) and the S7-1500 TM PosInput 2 (6ES7551-1AB00-0AB0). They are standard modules and may be used only for non-safety visualization or trend logging.

5. Safety Encoder Integration Path on PROFINET/PROFIsafe

The most common, lowest-effort path is a single-channel PROFIsafe-over-PROFINET safety encoder connected directly to the F-CPU's PROFINET interface. No additional F-I/O is required because the PROFIsafe payload is generated inside the encoder. Engineering steps in TIA Portal V17 / V18 / V19:

1. Install the manufacturer GSDML (e.g., GSDML-V2.35-SICK-AHS_AHM-20180126.xml) under Options → Manage General Station Description Files (GSD).
2. Add the encoder to the PROFINET topology and assign the F-CPU as the F-Host with PROFIsafe address 1.
3. Assign a unique PROFIsafe address to the encoder (default 1; user-configurable via DIP or web server, must match TIA Portal assignment).
4. Insert the F-Slot 1 module (typically "F-Input module, 16-bit position, 16-bit speed"). The slot generates two F-DBs: <DB_name>_i_Si (input) and a corresponding tag list.
5. Configure the F-monitoring time to ≤ 50 ms (default 100 ms; tighten if your stop category requires faster reaction).

The SICK AHS36 default slot exposes the following input word layout:

Verify the slot description in the manufacturer manual – SICK AHS/AHM in the safety variant uses slot 1 sub-slot 1 with the standard PROFIsafe profile 0x3AFD. The Kübler Sendix F5868 uses profile 0x3AFE (manufacturer-specific).

6. Rotation-Detection Algorithm in the F-Program

The fail-safe OB processes the speed word and applies a hysteresis comparator. Threshold selection follows IEC 61800-5-2 §5.2.6: the threshold must be set above the encoder's quantization noise (typically > 3 × LSB) and below the speed that would compromise safety. For a centrifuge with 1000 rpm and a 16-bit encoder, the LSB is ~0.23 rpm; a threshold of 5 rpm is a reasonable SSM v_threshold.

Example in Structured Text (F-program) running in OB 35 (cycle 100 ms):

// ============================================================
//  F-OB 35 – Rotation detection for guard interlock
//  CPU    : S7-1515F-2 PN (V2.9)
//  Encoder: SICK AHS36B-S1PC0 PROFIsafe, 16 bit ST
//  Cycle  : 100 ms
// ============================================================

FUNCTION_BLOCK FB_SafetyRotationDetect
VAR_INPUT
    i_ActualSpeed    : INT;     // IW 2 from safety encoder, rpm/4
    i_EncoderStatus  : WORD;    // IW 4 status word
    i_ResetAck       : BOOL;    // From operator panel (safe input)
END_VAR
VAR_OUTPUT
    o_RotationActive : BOOL;    // TRUE = shaft is turning
    o_FaultPresent   : BOOL;    // TRUE = encoder invalid
END_VAR
VAR
    s_ThresholdHi    : INT := 5;    // rpm
    s_ThresholdLo    : INT := 3;    // rpm (hysteresis)
    s_TimerSSM       : TON;        // 500 ms confirmation
    s_InternalState  : BOOL;       // internal hysteresis flag
END_VAR

BEGIN
    // Status evaluation – encoder must report valid
    o_FaultPresent := (i_EncoderStatus AND 16#0001) = 0;   // Bit 0 = valid

    // Absolute speed for threshold comparison
    IF ABS(i_ActualSpeed) > s_ThresholdHi THEN
        s_TimerSSM(IN := TRUE, PT := T#500ms);
    ELSIF ABS(i_ActualSpeed) < s_ThresholdLo THEN
        s_TimerSSM(IN := FALSE);
        s_InternalState := FALSE;
    END_IF;

    IF s_TimerSSM.Q AND NOT s_InternalState THEN
        s_InternalState := TRUE;     // Latch rising edge
    END_IF;

    o_RotationActive := s_InternalState AND NOT o_FaultPresent;
END_FUNCTION_BLOCK

The 500 ms confirmation timer prevents nuisance trips during the brief pulse-to-pulse window at very low speeds where the index (Z) pulse method would otherwise introduce delay. The same value also filters a single erroneous PROFIsafe telegram.

7. Ladder Equivalent for Engineers Using F-LAD/F-FBD

Engineers who prefer ladder in TIA Portal can build the same logic using the F-FBD editor inside the F-OB:

Network 1 – Fault aggregation
  ---|  /bit_0  |---( o_FaultPresent )--
  i_EncoderStatus.X0 (inverted)

Network 2 – Comparator (high threshold)
  i_ActualSpeed ---[ ABS ]---[ > +5 ]---[ & timer.Q ]---( o_RotationActive )
  -i_ActualSpeed -------------------------------------|

Network 3 – Comparator (low threshold, reset)
  i_ActualSpeed ---[ ABS ]---[ < +3 ]---[ S_internalState reset ]
  -i_ActualSpeed -------------------------|

The F-Compiler in TIA Portal will tag o_RotationActive with the F-attribute automatically. Do not attempt to read it from the standard OB; build a data exchange flag (DB with F-attributed variable) if the standard program needs to consume the result.

8. Wiring and Shielding

Encoder cable selection, shield bonding, and bending radius are part of the safety chain because cable faults must be detected by the encoder's internal diagnostics. Follow the manufacturer EMC guide; in general:

• Use only the manufacturer-supplied PROFINET cable (e.g., SICK LTG-2411-MW for fixed installation, LTG-2612-MW for flexible). Catalog number example: SICK cable portfolio.
• Bend radius ≥ 8 × outer diameter for fixed, ≥ 12 × for drag-chain.
• Ground the encoder body to a clean machine ground (≤ 1 Ω to the cabinet PE). Do not use the shield as a functional conductor.
• Maintain < 30 V/m RF immunity per EN 61000-4-3; route at least 200 mm from VFD output cables or use a steel separator.

Power the encoder from a PELV/SELV 24 V source. For SICK AHS36 the supply range is 10–30 V DC, current consumption ≤ 80 mA.

9. Verification Procedure

Before placing the safety function in service, complete the following checklist:

1. Functional check – cold: With drive disabled, the encoder must report speed = 0 and o_RotationActive must be FALSE within 500 ms of power-up.
2. Functional check – rotating: With drive at 100 % setpoint, verify o_RotationActive transitions to TRUE within 500 ms of crossing the high threshold.
3. Functional check – slow stop: Command SS1. Confirm o_RotationActive transitions to FALSE within 1.5 × i_MaxStopTime after speed drops below threshold.
4. Diagnostic coverage: Disconnect the PROFINET cable at the encoder. The F-CPU must report a PROFIsafe communication error (F-stop) within the configured F-monitoring time (50 ms).
5. Cross-check: Force a position step of 4 × LSB via the encoder test interface; verify the device reports i_StatusWord.Bit0 = 0 and the F-program forces the safe state.
6. PFHd calculation: Document the per-channel PFHd of the encoder (e.g., 8.5 × 10⁻⁹ /h for AHS36) and the subsystem PFHd in the safety validation report.

10. Diagnostic Tools in TIA Portal

The Safety Diagnostics view in TIA Portal (online → Safety → Show F-Diagnostics) displays the live PROFIsafe status, the passivated inputs, and the diagnostic buffer entry with timestamp and stack trace. Common diagnostic event IDs and their meaning:

Event IDs are SICK-specific; consult the Kübler or IFM manual for the equivalent table before sign-off.

11. Troubleshooting Matrix

12. Why the Z-Pulse / Index Method Is Not Sufficient

A common shortcut proposed in field discussions is "wait for the index (Z) pulse; if it does not appear within T seconds, the encoder is not rotating." This logic has two failure modes that are unacceptable in safety applications:

1. Detection latency at low speed: At 5 rpm on a 500 ppr encoder, the period between Z pulses is 12 s. The safety response time becomes 12 s × safety factor – orders of magnitude above IEC 61800-5-2 requirements.
2. Single-fault blindness: A broken index track on the code disc does not result in a deterministic "no Z pulse" state – it may produce a valid Z pulse on one revolution and not the next, defeating the test.

The proper solution is continuous speed measurement from a two-channel safety encoder with internal diagnostics, exactly as the SSM function in IEC 61800-5-2 requires.

13. Migration Path from FM 350 Installations

Many legacy systems use the FM 350-1/350-2 for non-safe rotation detection. The migration to a safety-rated path is straightforward:

1. Keep the FM 350 for non-safe visualization or trend recording. Mark all such tags clearly as non-safety.
2. Install the safety encoder on a separate shaft or replace the existing encoder with a PROFIsafe variant (e.g., SICK AHM36 if the original was a standard multiturn).
3. Add the F-slot in TIA Portal and bind the new safe input tags to the rotation detection FB.
4. Update the safety validation report with the new PFHd figures.

The original FM 350 program blocks (FCs 1–7 for FM 350-1, FB 1–2 for FM 350-2) remain usable for non-safety purposes – they do not interfere with the F-program.

14. Variant: When the Drive Provides the Safe Speed Signal

If the application already uses a SINAMICS drive (S120, G120, G150) with Safety Integrated Extended Functions, the drive generates the PROFIsafe speed and position values and exposes them via telegram 701 (PROFIsafe). In this case, no external safety encoder is required – the drive's own encoder is used, and the SSM bit is computed inside the drive and reported to the F-CPU. Activate the function in Startdrive / SCOUT:

• p9501.0 = 1 → enable Safety Integrated
• p9545 = SSM threshold (rpm)
• p9550 = SSM hysteresis (rpm)
• r9722.0 → SSM active (TRUE = speed below threshold)

This is the preferred architecture when the application already has SINAMICS. See the SINAMICS S120 Safety Integrated Function Manual for parameter details.

15. Performance Numbers and Bounded Response Times

End-to-end response time from a real rotation event to o_RotationActive updating:

For SS1 with a 1.5 s stop category, 1.3 s end-to-end detection is well within budget. For SS2 followed by guard release, tighten the F-OB cycle to 20 ms and the SSM timer to 100 ms to achieve < 250 ms end-to-end.

16. Field-Proven Caveats

• Never share the 24 V supply of the safety encoder with a non-safety inductive load. Transients from a contactor coil can inject > 50 V spikes that pass the under-voltage test of the encoder supply and corrupt the safety channel.
• Mechanical slip between the encoder shaft and the load is a hidden failure. For applications where slip is plausible (belt drive, friction coupling), install two encoders on independent shafts and use a 1oo2 architecture, or use a toothed belt with positive engagement.
• Do not connect the encoder PROFINET cable to a non-managed switch. PROFINET IRT and PROFIsafe require deterministic switching. Use a managed switch with PROFINET conformance class C or higher (e.g., SCALANCE XC-200).
• After every firmware update of the encoder, re-run the verification procedure in full and update the safety validation report with the new firmware version.
• PROFIsafe addresses are device-specific. Two encoders on the same PROFINET network must have different addresses, and the addresses must match the TIA Portal configuration exactly – mismatch causes a fatal F-stop that requires manual acknowledgement.

17. Summary

Replacing the non-safe FM 350 path with a PROFIsafe safety encoder connected to an S7-1500F or S7-1200F CPU is the standard solution for "is the load rotating?" safety functions. The implementation must follow IEC 61800-5-2 SSM semantics, use a safety encoder with a documented PFHd value, process the speed in the F-OB with hysteresis and a confirmation timer, and be verified end-to-end before commissioning. Index-pulse-only methods are not acceptable. Drive-integrated safety (SINAMICS Safety Integrated) is a valid alternative when the drive itself owns the encoder and is configured for SSM.

FAQ